Copyright © 2021 Mercer. All rights reserved.
THIS PRIVACY NOTICE IS FOR ALL VISITORS FROM SOUTH AFRICA
“Mercer” shall mean Mercer South Africa (Pty) Ltd
Mercer is committed to safeguarding the privacy of individuals whose personal information it processes in the course of providing services (you). This privacy notice (the Privacy Notice) describes how Mercer (we, us, our) collect personal information, and how we will use that personal information, in connection with the career workforce products that we provide to our clients.
We may have or collect additional personal (and other) information about you in relation to other relationships that we have with you. Where we collect this additional personal information as a controller, how we collect and handle this personal information may be set out in other Mercer privacy notices and terms and conditions
This Privacy Notice covers the following areas
(1) Our status
(2) Information we collect about you
(3) How we use your personal information
(4) Who we share your personal information with
(5) How we protect your personal information
(6) Your rights
(7) Contacting us
(8) Changes to our Privacy Notice
When we process your personal information in connection with our workforce products, we act as an independent data controller alongside your employer to whom we are providing our services and who also acts as a data controller. We work with our employer clients to meet our respective obligations under data protection law.
This Privacy Notice only applies in relation to the processing of personal information that we undertake as a controller in relation to our career workforce products. It does not apply to activities that we perform as a processor on behalf of our clients.
We will collect and process some or all of the following personal information about you:
(a) Information provided by you (or your employer on your behalf) or from publically available sources:
(b) Our correspondence
If you contact us, we will typically keep a record of that correspondence.
(c) Website and communication usage
This section sets out the purposes for which we use personal information that we collect and, in compliance with our obligations under South Africa data protection law, identifies the “legal grounds” (or “use justifications”) which we rely on to process the information (the full description of each of these grounds can be found in Annex 1 to this Notice.
We may use your personal information for the following purposes:
(a) Compensation, Benefit and Human Resources Benchmarking and Analysis
For the production of our Workforce Analytics (Comptryx) and Mercer Remuneration and Policy Surveys and Guides with the aim of providing products and services to our employer clients in respect of job matching, gender equality, organization design and industry remuneration and compensation benchmarking.
Use justification: contract performance and legitimate interests (to enable us to perform our obligations and provide our services to you)
(b) Data analytics and anonymization
To conduct benchmarking, modelling and data analytics in order to better understand issues relevant for assessing issues in the sphere of remuneration and human resources.
Use justification: Legitimate interests (to enable us to perform our contractual obligations and allow us to improve our service), legal obligation.
(c) Regulatory compliance
To undertake such other activities as are required in order to meet our ongoing regulatory, legal and compliance obligations, including the prevention and detection of crime, for fraud detection purposes, anti-money laundering and sanctions checks and in order to liaise with statutory bodies
Use justification: legitimate interests (to enable us to perform our contractual obligations and to cooperate with our regulators), legal obligation.
(d) To communicate effectively with our clients
To conduct our business, including to respond to our clients’ queries and to otherwise communicate with our clients, including to inform them of changes to our services and products and to handle claims.
Use justification: legitimate interests (to enable us to perform our obligations and provide our services to you), legal obligations, and legal claims
(e) To reorganize or make changes to our business
To share data as part of any due diligence process, or following a sale or reorganization, in the event that we: (i) are subject to negotiations for the sale of all or part of our business to a third party; (ii) are sold to a third party; or (iii) undergo a reorganization.
Use justification: Legitimate interests (in order to allow us to change or business).
We may share your personal information with the following categories of recipients:
(a) Our clients, such as your employer or former employer and their respective service providers or such other third parties as they instruct us to release the personal data to on their behalf
(b) Law enforcement bodies, third party agencies and sanctions lists, in connection with the prevention or detection of criminal activities, including fraud;
(c) Public authorities, regulators and government bodies, where this is necessary for us to comply with our legal and regulatory obligations;
(d) Advisers, including legal advisers, loss adjusters and claims investigators, in connection with the investigation, exercise or defense of legal claims;
(e) Our affiliates in the MMC Group and our commercial partners who are licensed to market our products in other territories;
(f) Third parties (and their advisers) in the event of a sale or reorganization of our business;
(g) Third party suppliers to whom we have outsourced certain activities, who process personal information on our behalf.
We maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal information in accordance with data protection legislative requirements.
All personal information that we hold is stored on our secure servers and only accessed and used subject to our security policies and standards.
Your personal information may be accessed by staff or suppliers in, transferred to, and/or stored at, a destination outside the country in which you are located. We will, in all circumstances, safeguard personal information as set out in this Privacy Notice.
Where we transfer personal information outside South Africa we are required to take specific measures to safeguard the relevant personal information. Certain countries outside South Africa have been approved as providing essentially equivalent protections to South Africa data protection laws and therefore no additional safeguards are required to export personal information to these jurisdictions. In countries which are not subject to this approval, we will establish legal grounds justifying such transfer, such as MMC Binding Corporate Rules, model contractual clauses, or other legal grounds permitted by applicable legal requirements.
Please contact us as set out below if you would like to see a copy of the specific safeguards applied to the export of your personal information.
We will retain your personal information for as long as is necessary for the processing purpose(s) for which it was collected and any other permitted linked purpose (for example where we are required to retain personal information for longer than the purpose for which we originally collected it in order to comply with certain regulatory requirements). Our retention periods are based on business needs and your information that is no longer needed is either irreversibly anonymized (and the anonymized information is retained) or securely destroyed.
If you have any questions or concerns about how your personal information is handled in connection with your employment, we recommend that you first contact your employer. However, under certain conditions, you have the right to ask us to:
a) Provide you with further details on the use we make of your information;
b) Provide you with a copy of information that you have provided to us;
c) Update any inaccuracies in the personal information we hold; and
d) Delete any personal information that we no longer have a lawful ground to use,
e) Object to any processing that we justify on the basis of our “legitimate interests” unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights;
f) Object to direct marketing (including any profiling for such purposes);
g) Restrict how we use your information whilst we consider your inquiry; and
h) Where processing is based on consent, you have the right to withdraw your consent by contacting us at the contact details below or as indicated when consent was given.
You can exercise these rights by contacting us as set out in the “contacting us” section below. Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). If you exercise any of these rights we will check your entitlement and respond in most cases within a month.
If we are unable to resolve an enquiry or a complaint, individuals have the right to contact the Information Regulator of South Africa.
If you have any question about how your personal information is handled, we recommend that you contact the relevant participating employer in the first instance.
If you have any questions in relation to this Privacy Notice, please contact our Information Officer at InformationOfficerSA@Mercer.com
We may change our Privacy Notice from time to time in the future. If we change this Privacy Notice, we will update the date the Privacy Notice was last changed below. If these changes are material, we will take reasonable steps to notify you of the changes.